dovecot - Nov 2009 - panic 1.2.7

Im getting a panic from a specific user:

Nov 11 13:53:29 userimap24.xs4all.nl dovecot: IMAP(xxxxxx): Panic:  
file maildir-uidlist.c: line 1242  
(maildir_uidlist_records_drop_expunges): assertion failed: (recs[i]- 
 >uid < rec->uid)
Nov 11 13:53:29 userimap24.xs4all.nl dovecot: IMAP(xxxxxx): Raw  
backtrace: imap [0x4a6c02] -> imap [0x4a6c83] -> imap [0x4a6346] ->  
imap [0x444d6d] -> imap(maildir_uidlist_sync_finish+0x2d3) [0x445d83] - 
 > imap [0x440d7e] -> imap(maildir_storage_sync_init+0x148) [0x441338]  
-> imap(mailbox_sync+0x30) [0x46d3b0] -> imap(imap_status_get+0x88)  
[0x42a9d8] -> imap(cmd_status+0x12f) [0x421e0f] -> imap [0x423b7c] ->  
imap [0x423c2d] -> imap(client_handle_input+0x45) [0x423da5] ->  
imap(client_input+0x5f) [0x42473f] -> imap(io_loop_handler_run+0xcb)  
[0x4aedab] -> imap(io_loop_run+0x18) [0x4ae228] -> imap(main+0x537)  
[0x42c707] -> /lib/libc.so.6(__libc_start_main+0xe6) [0x7f0cef0471a6] - 
 > imap [0x41c859]
Nov 11 13:53:30 userimap24.xs4all.nl dovecot: dovecot: child 3594  
(imap) killed with signal 6 (core dumps disabled)

1.2.7, Linux/Debian Lenny, amd64, NFS spool and index.

Seems to be happing every few minutes, probably every time they check  
mail. The command they're sending:

A002 STATUS "INBOX" (MESSAGES UNSEEN RECENT)

Output doesnt show any result, only their login:

A001 OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID  
ENABLE SORT THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT IDLE  
CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC  
ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH STARTTLS AUTH=PLAIN  
QUOTA] Logged in

Regards,

Cor

Im seeing multiple users with this same panic now. Probably a few an  
hour (out of tens of thousands of users, so nothing overly dramatic),  
and a new panic as well:

Nov 11 14:34:59 userimap20.xs4all.nl dovecot: IMAP(yyyyyy): Panic:  
file maildir-uidlist.c: line 403  
(maildir_uidlist_records_array_delete): assertion failed: (pos != NULL)
Nov 11 14:34:59 userimap20.xs4all.nl dovecot: IMAP(yyyyyy): Raw  
backtrace: imap [0x4a6c02] -> imap [0x4a6c83] -> imap [0x4a6346] ->  
imap [0x44347c] -> imap(maildir_uidlist_refresh+0x8f5) [0x444425] ->  
imap [0x440e60] -> imap(maildir_storage_sync_init+0x148) [0x441338] ->  
imap(imap_sync_init+0x68) [0x42bc88] -> imap [0x41eeee] -> imap  
[0x45e37e] -> imap(io_loop_handle_timeouts+0xfb) [0x4ae4ab] ->  
imap(io_loop_handler_run+0x71) [0x4aed51] -> imap(io_loop_run+0x18)  
[0x4ae228] -> imap(main+0x537) [0x42c707] -> /lib/libc.so. 
6(__libc_start_main+0xe6) [0x7f913b3b11a6] -> imap [0x41c859]
Nov 11 14:34:59 userimap20.xs4all.nl dovecot: dovecot: child 11196  
(imap) killed with signal 6 (core dumps disabled)